Claude Code 2.1.305: sandbox namespaces, MCP allowlist

Claude Code 2.1.305 is the newest entry in Anthropic's changelog, after 2.1.304. The entry shows no release date. Two changes matter if you manage settings: a new sandbox option that loosens file protections, and an MCP allowlist change that can load a server you had left out. Everyone else gets clearer /usage warnings.

This brief picks up after the 2.1.303-2.1.304 notes. It is not the full list.

This site is independent and not affiliated with Anthropic. We read the changelog and the docs on 2026-10-21. We did not install or run 2.1.305, so nothing below is a hands-on result.

A sandbox option that loosens file protections

Anthropic's sandbox page says "The Bash sandbox is a boundary that the operating system enforces around the shell commands Claude runs on your machine." The 2.1.305 entry adds a switch for Linux:

Added sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces (Chromium, rootless podman); this lets them get around the sandbox's file protections

The entry itself says the trade: tools like Chromium and rootless podman work, and the sandbox protects your files less. It does not say whether the setting is on by default, and the sandbox page we read does not mention it. Leave it alone unless a tool you need fails inside the sandbox.

An MCP allowlist change to check before upgrading

This one can surprise an admin. An MCP server is a tool connection that Claude can call. The changelog says:

Changed allowedMcpServers to stop filtering managed-mcp.json stdio servers that use ${VAR} only in env: one your allowlist left out now loads on upgrade; use deniedMcpServers to keep it off

Read that as a warning. A server your allowlist excluded can start loading after the upgrade, if it matches the pattern in the entry. If you want it off, add it to deniedMcpServers. Anthropic's MCP page describes the allowlist and denylist settings. Our managed settings guide shows where organization settings live.

Managed permissions and Desktop plugins

A second admin change touches plugins that Claude Desktop mounts by path:

Changed plugins that Claude Desktop mounts by path to no longer keep their allowed-tools when your organization's managed settings set allowManagedPermissionRulesOnly

In plain terms, with that managed setting on, those plugins no longer keep the tool permissions they declared. The entry does not say what a plugin author sees when this happens.

The Claude moves worth stealing, by email

Workflows tested on real jobs, sent only when they are worth it. Free.

Subscribe

/usage becomes a to-do list

The change most people will notice is in /usage:

Improved /usage: each warning is now a one-line fix that names its source, and f applies the fixes; the same fixes appear in VS Code and /doctor

Pressing f applies the fixes, so read each line first. The entry does not list what a fix can change. For how the plan limits themselves work, see our rate limits guide.

Unattended retries notice a lifted limit

A new environment variable helps runs nobody is watching:

Added CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS so unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG) notices a usage limit that was lifted before its reset

The entry gives no default for the interval and no example value. Our guide on the overloaded retry delay covers the related 529 case.

Smaller changes worth a glance

• Artifacts: the /artifacts delete confirmation now takes "1 or Enter to keep, 2 to delete, and Esc to cancel"; y and n no longer answer it. The 2.1.304 brief covers the earlier numbered choices.
• MCP consent: dialogs are changed "so an Enter meant for the prompt is less likely to be taken as Accept".
• Code Review: re-reviews "no longer open with LGTM while earlier blocking findings are still open". Our Code Review launch brief explains the service.

Upgrade readout

If you	Do this
Manage MCP servers for a team	Check deniedMcpServers before you upgrade
Use the Linux sandbox	Leave sandbox.allowNestedUserNamespaces off unless a tool needs it
Run unattended retries	Look at the new recheck variable
Use /usage	Read each fix before pressing f
Anyone else	Routine upgrade

What this brief does not cover

The changelog lists 22 bug fixes for 2.1.305, and we did not go through them item by item. We did not run any command or setting named above. The entry gives no date, so we cannot say when it shipped.

What does sandbox.allowNestedUserNamespaces do in Claude Code?

It lets sandboxed commands on Linux create user namespaces, which tools such as Chromium and rootless podman need. The changelog adds that this lets them get around the sandbox's file protections, so enable it only when a tool fails without it.

Will Claude Code 2.1.305 load MCP servers my allowlist blocked?

It can. The changelog says a managed-mcp.json stdio server your allowlist left out now loads on upgrade when it uses ${VAR} only in env. Add it to deniedMcpServers to keep it off.

What does pressing f do in /usage?

Per the changelog, each /usage warning is now a one-line fix that names its source, and f applies the fixes. The entry does not list what a fix changes, so read each line before you press it.

Sources (checked 2026-10-21)

• Claude Code changelog: the 2.1.305 entry.
• Configure the sandboxed Bash tool: what the sandbox is.
• Connect Claude Code to tools via MCP: the allowlist and denylist settings.